mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-25 08:09:07 +02:00
65 lines
1.7 KiB
Go
65 lines
1.7 KiB
Go
package tpm
|
|
|
|
import (
|
|
"crypto"
|
|
"crypto/ecdsa"
|
|
"crypto/elliptic"
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"encoding/pem"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"go.step.sm/crypto/tpm/tss2"
|
|
|
|
"github.com/netbirdio/netbird/client/internal/tpm/tpmtest"
|
|
)
|
|
|
|
func TestParseKey_ReportsPublicKeyWithoutTouchingTPM(t *testing.T) {
|
|
key := newP256Key(t)
|
|
|
|
signer, err := ParseKey(decodePEM(t, tpmtest.KeyPEM(t, &key.PublicKey)))
|
|
require.NoError(t, err)
|
|
assert.True(t, key.PublicKey.Equal(signer.Public()), "signer must expose the key the TPM holds")
|
|
}
|
|
|
|
func TestParseKey_RejectsKeyWithAuthorization(t *testing.T) {
|
|
key := newP256Key(t)
|
|
withAuth := func(k *tss2.TPMKey) { k.EmptyAuth = false }
|
|
|
|
_, err := ParseKey(decodePEM(t, tpmtest.KeyPEM(t, &key.PublicKey, withAuth)))
|
|
assert.ErrorIs(t, err, ErrKeyNeedsAuth)
|
|
}
|
|
|
|
func TestParseKey_RejectsMalformedKey(t *testing.T) {
|
|
_, err := ParseKey([]byte("not a TSS2 key"))
|
|
assert.Error(t, err)
|
|
}
|
|
|
|
func TestSign_FailsWhenTPMIsUnreachable(t *testing.T) {
|
|
t.Setenv(DeviceEnv, filepath.Join(t.TempDir(), "missing"))
|
|
signer, err := ParseKey(decodePEM(t, tpmtest.KeyPEM(t, &newP256Key(t).PublicKey)))
|
|
require.NoError(t, err)
|
|
|
|
digest := sha256.Sum256([]byte("challenge"))
|
|
_, err = signer.Sign(rand.Reader, digest[:], crypto.SHA256)
|
|
assert.Error(t, err, "signing must not fall back to software when the TPM is missing")
|
|
}
|
|
|
|
func newP256Key(t *testing.T) *ecdsa.PrivateKey {
|
|
t.Helper()
|
|
key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
|
require.NoError(t, err)
|
|
return key
|
|
}
|
|
|
|
func decodePEM(t *testing.T, pemData string) []byte {
|
|
t.Helper()
|
|
block, _ := pem.Decode([]byte(pemData))
|
|
require.NotNil(t, block)
|
|
require.Equal(t, KeyPEMType, block.Type)
|
|
return block.Bytes
|
|
}
|